1.8 Identify the Challenges of Data Visibility (network, Host, and Cloud) in Detection 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   A company uses a public cloud provider for infrastructure. The cloud provider is responsible for securing the physical hosts, while the company must secure its virtual machines and applications. Which cloud visibility challenge does this scenario describe?

   • ALateral movement in the cloud
   • BEphemeral resources
   • CAPI-based access
   • DShared responsibility model
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security operations center (SOC) is investigating a potential lateral movement attack. The analysts see that an internal host connected to several other internal hosts over SMB. However, the SOC cannot see the content of the SMB sessions. What is the most likely reason for this visibility gap?

   • AThe network monitoring tool is not configured to capture SMB traffic.
   • BThe internal hosts are in different VLANs and cannot communicate.
   • CThe SOC does not have access to the host logs.
   • DSMB traffic is always encrypted and cannot be inspected.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   An attacker on a compromised host deletes log files and modifies timestamps to hide their activity. Which host data visibility challenge does this behavior exemplify?

   • AEncrypted communication channels
   • BEndpoint diversity
   • CAnti-forensics techniques
   • DResource constraints on the host
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst is investigating a potential data breach. The analyst has access to network flow logs, host logs, and cloud API logs. The analyst notices that a large file was transferred from an internal host to a cloud storage service. The network flow logs show the transfer, but the host logs do not show any file access. What is the most likely explanation for this discrepancy?

   • AThe host logs are encrypted and cannot be read.
   • BThe file transfer was performed by a process that is not logging to the host.
   • CThe cloud storage service is not logging the transfer.
   • DThe network flow logs are incorrect and the transfer did not happen.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   A security team deploys a single host-based monitoring agent across all endpoints. Which host data visibility challenge is most likely to reduce the effectiveness of this approach?

   • AEncryption of network traffic between hosts
   • BLack of a central logging server
   • CLimited number of network taps
   • DEndpoint diversity with different operating systems and configurations
   Reveal Solution Discussion Select an answer first